PT-2026-39293 · Bitcoin · Bitcoinj

Published 2026-05-08 · Updated 2026-05-18 · CVE-2026-44714

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions bitcoinj versions prior to 0.17.1

Description The correctlySpends() function in core/src/main/java/org/bitcoinj/script/ScriptExecution.java contains two fast-path verification bugs affecting standard P2PKH (Pay-to-PubKey-Hash) and native P2WPKH (Pay-to-Witness-PubKey-Hash) spends. The library verifies an attacker-controlled signature and public-key pair but fails to confirm that the public key matches the one committed to by the output being spent. Consequently, any attacker keypair can satisfy local verification for arbitrary P2PKH and P2WPKH outputs. This issue does not affect the SPV (Simple Payment Verification) trust model, as that model follows Proof of Work and does not verify input signatures.

Recommendations Update to version 0.17.1.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-44714

GHSA-HFCF-V2F8-X9PC

Affected Products

Bitcoinj

References · 8

• https://osv.dev/vulnerability/GHSA-hfcf-v2f8-x9pc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44714 · Security Note
• https://github.com/bitcoinj/bitcoinj/commit/b575a682acf614b9ff95cacbdeb48f86c3ababe0 · Note
• https://github.com/bitcoinj/bitcoinj/commit/2bc5653c41d260d840692bc554690d4d79208f9c · Note
• https://github.com/bitcoinj/bitcoinj/releases/tag/v0.17.1 · Note
• https://github.com/bitcoinj/bitcoinj · Note
• https://github.com/bitcoinj/bitcoinj/security/advisories/GHSA-hfcf-v2f8-x9pc · Note
• https://t.me/cveNotify/163914 · Telegram Post